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Abstract 



The invention provides improved computer network firewalls which include one or more features for 
increased processing efficiency. A firewall in accordance with the invention can support multiple security 
policies, multiple users or both, by applying any one of several distinct sets of access rules. The firewall 
can also be configured to utilize "stateful" packet filtering which involves caching rule processing results 
for one or more packets, and then utilizing the cached results to bypass rule processing for subsequent 
similar packets. To facilitate passage to a user, by a firewall, of a separate later transmission which is 
properly in response to an original transmission, a dependency mask can be set based on session data 
items such as source host address, destination host address, and type of service. The mask can be 
used to query a cache of active sessions being' processed by the firewall, such that a rule can be 
selected based on the number of sessions that satisfy the query. Dynamic rules may be used in addition 
to pre-loaded access rules in order to simplify rule processing. To unburden the firewall of application 
proxies, the firewall can be enabled to redirect a network session to a separate server for processing. 
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